ReadmeTagOne tag. Any content.

Privacy Policy

Last updated: October 15, 2026

1. Data controller

The data controller is: Pawel Horzela (a natural person conducting unregistered business activity), privacy contact: contact@readmetag.com, address: ul. Przewoz 44A / 15, 30-716 Krakow, Poland.

This document is prepared under the GDPR (EU Regulation 2016/679). As a controller established in the EU, we process user data regardless of the user's geographic location (GDPR Article 3(1)).

2. Data we collect

  • Business account: email address, company name, terms acceptance date and accepted terms version, subscription plan, and an account suspension marker where applicable (Terms section 6).
  • Pages: internal name, page type (Readme or Redirect), Markdown content, Redirect Page destination URL, publication status, public identifier (guid).
  • Content reports (/report): page guid, reason, description, optional reporter email, and a snapshot of the Page's content (Markdown or destination URL) at the time of the report — as evidence of what the report concerned, regardless of later changes made by the owner. If the reporter provides an email, we use it solely to confirm receipt of the report and to inform them of our decision (DSA Article 16).
  • View statistics: an aggregated daily view counter for each Page — no IP address, cookies, or any visitor identifier; this is a statistic, not a record of individual visits.
  • Anti-abuse counters (rate limiting): short-lived request counters in our database keyed by IP address (the /report form, sign-in, QR downloads, the view counter) and — when sending a sign-in link — by email address. Used only to limit spam and abuse. A daily cleanup deletes a counter once 24 hours have passed since the window started — at the latest after about 48 hours.
  • Blocked email list: the email address of an account permanently banned for a serious breach of the Terms (sections 6 and 12) — kept so that the same address cannot register again.
  • Technical logs: IP address, browser headers — via our hosting provider (Vercel) for security and diagnostics.
  • Payments and billing: Stripe customer and subscription identifiers, subscription status, paid Plan, and renewal date. At checkout Stripe collects the full business name, the full billing address, and a tax number when it supports one for that address's country. Stripe stores them, not our database. Payments are handled exclusively by Stripe — we do not store payment card numbers or other card data.

3. Purposes and legal bases (GDPR Article 6)

  • Contract performance — account management, page hosting, QR generation.
  • Legitimate interest — security (rate limiting, logs), content moderation, handling reports, and giving a Page owner aggregated statistics of its views.
  • Legal obligation — retention required by tax law where applicable.
  • Consent — only if we later enable marketing email (we do not send newsletters today).

4. Data recipients (processors)

Data may be shared with trusted providers necessary to operate the service:

  • Vercel — application hosting;
  • Neon — PostgreSQL database;
  • Resend — transactional email (magic links, report notifications);
  • Stripe — processing payments and subscriptions for paid Plans, including EU VAT number verification and VAT handling (Stripe Tax); Stripe acts as an independent processor of billing data and does not share payment card numbers with us;
  • Google (Web Risk API) — when enabled: checking URLs from page Content on publish against known threats (malware, phishing); we send Content URLs, not identifiers of end customers who scan QR codes.
  • OpenAI — automated classification of page Content text on publish (Moderation API); we send Markdown text, not identifiers of end customers who scan QR codes.
  • Cloudflare (Turnstile) — CAPTCHA verification on the sign-in form (magic link) and on /reportto block automated spam; Cloudflare processes the visitor's IP address and browser signals and may set its own cookie for this purpose.

We keep the database (Neon) in the European Union. Some of the other providers — including Vercel (hosting and diagnostic logs), Resend (transactional email), Cloudflare, Google, and OpenAI — are established in, or store logs in, the USA, even when the service itself (for example application compute or mail delivery) runs in an EU region. Those transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework — see each provider's current DPA.

We may disclose data to public authorities where required by law (for example a court or authority order, including under the DSA) or where necessary to protect the rights, safety, or property of us, our users, or third parties. If the service is sold, merged, or changes owner, data may be transferred to the successor, who must process it under protections at least as strong; we will notify you in advance by email.

5. Retention

  • Account data — for the life of the account; after a deletion request, 7 days to cancel, then deletion; backups up to about 30 days.
  • Page content — until deleted by the user (7-day undo window) or account termination. For Redirect pages this includes the destination URL you provide (not the content of the destination site).
  • /report submissions — up to 12 months after resolution; if a report is not resolved, up to 12 months after it was filed (notice-and-action evidence).
  • Content moderation logs — up to 12 months.
  • Hosting technical logs (Vercel) — up to about 30 days.
  • Anti-abuse counters (IP / email) — removed by the daily cleanup once 24 hours have passed since the window started (at the latest after about 48 hours).
  • Blocked email list — for as long as the ban stands (no fixed end date; basis: legitimate interest in preventing repeat breaches).
  • View statistics (aggregated, no IP) — up to 24 months, then deleted automatically.
  • Billing and tax records held by Stripe (business name, full billing address, tax number where Stripe collects one, payment confirmations) — for as long as required by applicable tax law (legal-obligation basis), independent of any earlier account deletion. We do not keep those numbers or that address in our database.

6. Your rights

You have the right to access, rectify, erase, restrict processing, data portability, object, and lodge a complaint with the Polish DPA (UODO) or your local supervisory authority — for example the ICO in the United Kingdom or the ANPD in Brazil. We apply a single global data protection standard based on the GDPR to every user regardless of country; we do not run separate, narrower compliance tracks for individual jurisdictions. Contact: contact@readmetag.com.

We respond to requests without undue delay and at the latest within one month of receipt (GDPR Article 12(3)). If a request is complex or numerous, we may extend that period by a further two months — in that case we will tell you, and why, within the first month. We may ask you to confirm your identity before disclosing or deleting data.

You can exercise the right to data portability yourself: the "Account" section of the dashboard lets you download a full export of your account data and the content of every page you own, as a JSON file.

7. Cookies

The admin dashboard requires technical session cookies (NextAuth). Pages /{guid} do not use analytics or marketing cookies by default. We use a NEXT_LOCALE cookie to remember your marketing and dashboard language preference. The sign-in page and the /report form embed Cloudflare Turnstile CAPTCHA, which sets its own technical cookie to distinguish humans from bots — only on those pages. If we later add analytics requiring consent, we will implement an ePrivacy-compliant banner with equal Accept/Reject options.

8. Security

We use Markdown sanitization, security headers (CSP), rate limiting, automated technical measures on publish (URL checks and text classification), and a reporting mechanism. These measures are best-effort and do not guarantee detection of every prohibited Content.

The English version of this Privacy Policy is canonical. In case of inconsistency with a translation, the English version prevails.